STMicroelectronics (Grand Ouest) SAS

In embodiments, a system includes a first and a second processing unit, a memory, and a firewall device. The first processing unit operates in a secure mode and generates memory access requests having a secure level. The second processing unit operates in a non-secure mode and generates memory access requests having a non-secure level. The memory includes a first memory area that can be shared between the first and second processing units. The firewall device includes a first firewall circuit with a first configuration authorizing access to the first memory area in the presence of a secure or non-secure level access request. The firewall circuit includes a second configuration prohibiting access to the first memory area in the presence of a secure level access request and authorizing access to the first memory area only in the presence of a non-secure level access request.

System, method, and circuitry for generating content for a programmable computing device based on user-selected memory regions. Contiguous regions that share memory access attributes are merged, interleaved contiguous regions that share at least one nested attribute are defined into combined regions, and remaining regions are defined as separate independent regions. A memory protection unit (MPU) region size closest to a size of each defined region is identified. If the start address of each region aligns with the address structure of the MPU region size, then those regions are assigned to MPU regions having the MPU region size; otherwise, another MPU size that aligns with the size of the regions is selected and those regions are assigned to MPU regions having that size. Content is generated to configure settings of MPU regions of the programmable computing device for the merged contiguous regions, the combined region, and the independent regions.

The method for managing access rights of memory regions of a memory comprises assigning an execution permission status for each memory region in a firewall device dedicated to the memory, so that the content of a memory region having an executable status is capable of being executed by a processor, and the content of a memory region having a non-executable status cannot be executed by the processor.

In an embodiment a method includes executing, during a first phase, one or more first codes stored in a first immutable zone of a non-volatile memory of an electronic device, forbidding, by an access control circuit of the non-volatile memory, execution of any codes stored in a second zone of the non-volatile memory during the first phase, executing, during a second phase, one or more second codes stored in the second zone and forbidding, by the access control circuit, any access to the first zone during the second phase.

In accordance with an embodiment, a system on chip includes: a plurality of master equipment; a plurality of slave resources, where a slave resource of the plurality of slave resources comprises a memory device includes a first memory area; an interconnection circuit; and a check circuit. A first master equipment is configured to define initial access rights for the first memory area, and to delegate access management of the first memory area to a second master equipment. The second master equipment is configured to define for the first memory area, particular access rights from the initial access rights associated with the first memory area and access right rules; and the check circuit is configured to check whether a transaction intended for the first memory area is indeed authorized to access the first memory area using applicable access rights associated with the first memory area.

In an embodiment a method for managing access rights of software tasks executed by a processing unit (CPU) using a cache memory containing execution data of the tasks in memory locations, each execution data having an attribute representative of a level of access right of the respective task, includes changing the attributes of the locations of the cache memory when the access rights of at least one task changes and retaining the execution data contained in the locations of the cache memory.

A method is provided for monitoring an execution of a selected program code portion stored in a memory address range between a start address and an end address. The method includes starting a timing when a program counter points to the start address of the selected program code portion. Current values of the program counter are compared with a set of target addresses specific to the selected program code portion including the end address of the selected program code portion. The timing is stopped when the program counter points to the end address of the selected program code portion. An error signal is generated in response to the timing duration being outside a nominal duration range specific to the selected program code portion.

An embodiment system for protecting a memory comprises security software configured to determine, from an exception generated during an unauthorized action attempt in the memory, whether the security software can perform the action.

System, method, and circuitry for generating content for a programmable computing device based on user-selected memory regions. Contiguous regions that share memory access attributes are merged, interleaved contiguous regions that share at least one nested attribute are defined into combined regions, and remaining regions are defined as separate independent regions. A memory protection unit (MPU) region size closest to a size of each defined region is identified. If the start address of each region aligns with the address structure of the MPU region size, then those regions are assigned to MPU regions having the MPU region size; otherwise, another MPU size that aligns with the size of the regions is selected and those regions are assigned to MPU regions having that size. Content is generated to configure settings of MPU regions of the programmable computing device for the merged contiguous regions, the combined region, and the independent regions.

In embodiments, a system includes a first and a second processing unit, a memory, and a firewall device. The first processing unit operates in a secure mode and generates memory access requests having a secure level. The second processing unit operates in a non-secure mode and generates memory access requests having a non-secure level. The memory includes a first memory area that can be shared between the first and second processing units. The firewall device includes a first firewall circuit with a first configuration authorizing access to the first memory area in the presence of a secure or non-secure level access request. The firewall circuit includes a second configuration prohibiting access to the first memory area in the presence of a secure level access request and authorizing access to the first memory area only in the presence of a non-secure level access request.